Unico IDtech
Bounty Range
$150 - $3,000
external program
Unico IDtech
Unico IDTech is pioneering the future of biometric authentication through our advanced liveness detection engine. We're inviting security researchers to help protect millions of digital identities by finding novel ways to bypass our state-of-the-art biometric controls.
The Bug Bounty program is now public and open to all security researchers. The following groups are not eligible:
Our Bug Bounty program is divided into two distinct scopes: Liveness and Web. Each scope targets specific areas of our systems, with a primary focus on testing the security controls associated with the Liveness scope.
For more details, please refer to IDCloud - DevCenter.
| Test Type | Success Criteria | Failure Criteria | When to Report |
|---|---|---|---|
| Photo Attack | Engine accepts static image as live | Engine correctly rejects static image | Report if bypass rate >1% over 100 attempts |
| Video Replay | Engine accepts pre-recorded video | Engine detects temporal inconsistency | Report if bypass successful on 3+ different samples |
| 3D Mask/Model | Engine accepts non-human presentation | Engine detects artificial surface | Report if any high-quality mask achieves >5% success rate |
| Deepfake | Engine accepts synthetic video stream | Engine detects manipulation artifacts | Report if real-time bypass achieved with <500ms latency |
| Test Type | Success Criteria | Failure Criteria | When to Report |
|---|---|---|---|
| Memory Manipulation | Modified engine parameters accepted | Tampering detected and rejected | Report if persistence across engine restarts |
| Template Injection | Artificial template processed as valid | Invalid template detected | Report if bypass work on multiple formats |
| Timing Attacks | Processing bypass through race condition | Proper sequence validation | Report if reproducible >50% of attempts |
| Test Type | Success Criteria | Failure Criteria | When to Report |
|---|---|---|---|
| Capture Relay | Reused biometric data accepted | Replay detected and blocked | Report if bypass works across sessions |
| Stream Manipulation | Modified data stream processed as valid | Data integrity check failure | Report if manipulation undetected by engine |
| Session Hijacking | Authentication state transferred | Session binding enforced | Report if state can be copied between instances |
Report when the SDK returns a positive liveness result for a presentation attack, following the criteria in the matrices above. Include Transaction ID and Process ID. Our team will validate the full bypass chain including backend verification.
The testing will focus on the biometric SDK, not the wrapper applications. The test applications serve solely to facilitate SDK testing and are out of scope. Vulnerabilities related to the biometric capture and processing engine are in scope, while issues related to the wrapper interface or presentation layer are out of scope.
System Requirements:
Web Testing: Web testing can be performed in any modern browser.
Physical Devices Required for Mobile Testing: The mobile applications (Android Native, iOS Native, Android Flutter, and iOS Flutter) DO NOT work on emulators or simulators. You must use physical devices for mobile testing.
Application Expiration (TTL): The mobile applications have a 30-day Time-To-Live (TTL). If the app stops working or shows expiration errors, download and install the latest version from the links above. Web application does not expire.
Recommended Testing Approach: We strongly recommend using the native apps (Android Native and iOS Native) for mobile testing. The native apps offer smoother performance and more direct SDK integration. Flutter apps are provided for convenience but use the native SDKs as a bridge layer.
| Vulnerability Type | When to Report a Problem |
|---|---|
| XSS | A simple alert(document.domain) is enough. |
| RCE | Please only run harmless code. Simply printing something or evaluating an expression should be enough to demonstrate the problem. |
| SQLi | Please report it as soon as you experience a SQL error that indicates SQL injection or you are able to disclose the SQL server version number. |
| SSRF | Do not play on any internal networks. Let us know as soon as you believe you have a possible SSRF issue and we will look into it for you. |
| JWT Tokens Vulnerabilities | Injecting self-signed tokens or breaking authorization controls. |
| IDOR | Access confidential information from another user/organization or users with greater privileges. |
| Unrestricted File Upload | Upload a simple shell, a file with an extension or content-type different from those requested. |
Using the OWASP Risk Rating calculator will be greatly appreciated.
Researchers should add headers to requests such as:
When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:
| Severity | Reward |
|---|---|
| Low | $150–$300 |
| Medium | $500–$2,000 |
| High | $1,250–$5,000 |
| Critical | $3,000–$10,000 |
Our rewards are based on severity per CVSS (the Common Vulnerability Scoring Standard). Please note these are general guidelines, and reward decisions are up to the discretion of Unico IDtech.
Adheres to Gold Standard Safe Harbor and is fully compliant with Platform Standards.